CVE-2021-20594: Infoleak
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU all versions allows a remote unauthenticated attacker to acquire legitimate user names registered in the module via brute-force attack on user names.
Other sources
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions "11" and prior allows a remote unauthenticated attacker to acquire legitimate user names registered in the module via brute-force attack on user names.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-20594?
The severity of CVE-2021-20594 is high with a CVSS score of 7.5.
What is CVE-2021-20594?
CVE-2021-20594 is a vulnerability that allows unauthorized actors to access sensitive information in certain firmware versions of Mitsubishi Electric MELSEC iQ-R series Safety CPU modules and SIL2 Process CPU modules.
Which software versions are affected by CVE-2021-20594?
CVE-2021-20594 affects Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prior, as well as Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU all versions.
How can I fix the vulnerability CVE-2021-20594?
Mitsubishi Electric has released a firmware update to address the vulnerability. Users are advised to update to the latest available firmware version.
Where can I find more information about CVE-2021-20594?
More information about CVE-2021-20594 can be found on the official Mitsubishi Electric PSIRT webpage, as well as the JVN and CISA websites.